{"api_version":"1","generated_at":"2026-07-24T18:56:13+00:00","cve":"CVE-2021-20628","urls":{"html":"https://cve.report/CVE-2021-20628","api":"https://cve.report/api/cve/CVE-2021-20628.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2021-20628","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2021-20628"},"summary":{"title":"CVE-2021-20628","description":"Cross-site scripting vulnerability in Address Book of Cybozu Office 10.0.0 to 10.8.4 allows remote attackers to inject an arbitrary script via unspecified vectors. Note that this vulnerability occurs only when using Mozilla Firefox.","state":"PUBLIC","assigner":"vultures@jpcert.or.jp","published_at":"2021-03-18 01:15:00","updated_at":"2021-03-23 14:28:00"},"problem_types":["CWE-79"],"metrics":[],"references":[{"url":"https://kb.cybozu.support/article/36868/","name":"https://kb.cybozu.support/article/36868/","refsource":"MISC","tags":[],"title":"不具合情報公開サイト","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://jvn.jp/en/jp/JVN45797538/index.html","name":"https://jvn.jp/en/jp/JVN45797538/index.html","refsource":"MISC","tags":[],"title":"JVN#45797538: Multiple vulnerabilities in Cybozu Office","mime":"text/xml","httpstatus":"200","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-20628","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-20628","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2021","cve_id":"20628","vulnerable":"1","versionEndIncluding":"10.8.4","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"cybozu","cpe5":"office","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2021","cve_id":"20628","vulnerable":"-1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"mozilla","cpe5":"firefox","cpe6":"-","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"data_type":"CVE","data_format":"MITRE","data_version":"4.0","CVE_data_meta":{"ID":"CVE-2021-20628","ASSIGNER":"vultures@jpcert.or.jp","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"vendor_name":"Cybozu, Inc.","product":{"product_data":[{"product_name":"Cybozu Office","version":{"version_data":[{"version_value":"10.0.0 to 10.8.4"}]}}]}}]}},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"Cross-site scripting"}]}]},"references":{"reference_data":[{"url":"https://jvn.jp/en/jp/JVN45797538/index.html","refsource":"MISC","name":"https://jvn.jp/en/jp/JVN45797538/index.html"},{"url":"https://kb.cybozu.support/article/36868/","refsource":"MISC","name":"https://kb.cybozu.support/article/36868/"}]},"description":{"description_data":[{"lang":"eng","value":"Cross-site scripting vulnerability in Address Book of Cybozu Office 10.0.0 to 10.8.4 allows remote attackers to inject an arbitrary script via unspecified vectors. Note that this vulnerability occurs only when using Mozilla Firefox."}]}},"nvd":{"publishedDate":"2021-03-18 01:15:00","lastModifiedDate":"2021-03-23 14:28:00","problem_types":["CWE-79"],"metrics":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE","baseScore":6.1,"baseSeverity":"MEDIUM"},"exploitabilityScore":2.8,"impactScore":2.7},"baseMetricV2":{"cvssV2":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:N/I:P/A:N","accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE","baseScore":4.3},"severity":"MEDIUM","exploitabilityScore":8.6,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":true}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"AND","children":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:cybozu:office:*:*:*:*:*:*:*:*","versionStartIncluding":"10.0.0","versionEndIncluding":"10.8.4","cpe_name":[]}]},{"operator":"OR","children":[],"cpe_match":[{"vulnerable":false,"cpe23Uri":"cpe:2.3:a:mozilla:firefox:-:*:*:*:*:*:*:*","cpe_name":[]}]}],"cpe_match":[]}]}},"legacy_mitre":{"record":{"CveYear":"2021","CveId":"20628","Ordinal":"194673","Title":"CVE-2021-20628","CVE":"CVE-2021-20628","Year":"2021"},"notes":[{"CveYear":"2021","CveId":"20628","Ordinal":"1","NoteData":"Cross-site scripting vulnerability in Address Book of Cybozu Office 10.0.0 to 10.8.4 allows remote attackers to inject an arbitrary script via unspecified vectors. Note that this vulnerability occurs only when using Mozilla Firefox.","Type":"Description","Title":null},{"CveYear":"2021","CveId":"20628","Ordinal":"2","NoteData":"2021-03-17","Type":"Other","Title":"Published"},{"CveYear":"2021","CveId":"20628","Ordinal":"3","NoteData":"2021-03-17","Type":"Other","Title":"Modified"}]}}}